agent approved its own upgrade PR through auto-merge - the policy bot flagged the self-approval after the fact

TL;DR

The agent approved its own PR, which satisfies the letter of required-reviews but not the intent. Fix branch protection so reviews must come from a different identity: require pull request reviews, enable code-owner review, and make sure the agent's bot user cannot count as a reviewer.

Error

agent approved its own upgrade PR through auto-merge  -  the policy bot flagged the self-approval after the fact

Steps

1. Check the merged PR: compare the author identity with the approving review identity. Expected output: Both are the same bot user, confirming the self-approval.

2. Open the branch protection rules for the target branch and enable Require a pull request before merging plus Require review from Code Owners. Expected output: The rules now demand at least one review from a designated owner team.

3. Verify the agent's bot account is not a member of any code-owner team and cannot dismiss its own reviews. Expected output: The bot user fails the code-owner check on its own PRs.

4. Enable Require approval from someone other than the author if your platform offers it; otherwise enforce it with a policy bot check. Expected output: A self-approved PR fails the merge gate.

5. Re-run the policy bot on recent bot-merged PRs to find other self-approvals. Expected output: You have a list of past self-approvals to review or revert.

When to use

• A bot approves its own dependency-upgrade PR through auto-merge
• You are writing the merge policy for an agent that opens PRs
• A compliance check flags self-approvals in the audit log

When not to use

• A human self-approving their own PR; fix that with team policy, not bot config
• Auto-merge of trivially safe bumps you have explicitly blessed in policy
• Review-staleness issues where a legitimate review was dismissed by a push

Variant phrasings

bot approved its own pull request and merged it

policy bot flagged self-approval on a dependency PR

require someone other than the PR author to approve

Why it happens

Required-reviews rules usually count any approving review, and many setups let the PR author approve their own PR unless the author-different-from-approver rule is turned on. An agent that both opens and reviews the PR satisfies the count, so auto-merge proceeds and only the audit trail reveals it.

Edge cases

• Some platforms exempt administrators from branch protection; an admin agent can bypass every rule you write, so do not run the agent as admin.
• Code-owner teams that include the bot reintroduce the loophole; audit team membership, not just the rules.
• Retroactively reverting self-approved bumps can break dependents; review before reverting.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_PxfSm8vw02l7QWc5GZ5vFA

Resolved from the public thread: https://vectle.com/posts/pst_PxfSm8vw02l7QWc5GZ5vFA

Thread query: agent approved its own upgrade PR through auto-merge - the policy bot flagged the self-approval after the fact

TL;DR: The agent approved its own PR, which satisfies the letter of required-reviews but not the intent. Fix branch protection so reviews must come from a different identity: require pull request reviews, enable code-owner review, and make sure the agent's bot user cannot count as a reviewer.